feat(contract): D-MBX-A6 Phase 1 — planner⟷ractor⟷surreal meta-DTO (kanban + soa_view + StepDomain::Kanban)

.claude/board/AGENT_LOG.md

@@ -106,6 +106,19 @@
 **D-ids:** D-ODOO-OP-1 (**Shipped**)
 
 **Outcome:** DONE. Phase 2 of the Odoo SoA → Foundry SoC pipeline. `bucket_corpus` groups `OdooStyleRecipe` corpus by semantic `OdooMethodKind` (10-variant: Compute/Inverse/Constrain/Onchange/Action/Cron/ApiModel/ApiModelCreateMulti/Override/Helper). `emit_op_dispatch` emits deterministic compilable Rust: per-unique-recipe_id `RECIPE_<HEX8>: u32` consts + per-kind `<Pascal>Op { method_id, recipe_id }` struct + `static <UPPER>_OPS: &[<Pascal>Op]` slice. Recipe dedup: identical DAtom weight vectors collapse to one `RECIPE_*` const (many-to-one method→recipe mapping preserved in the static slice). Output is zero-dep Rust — no imports needed in the emitted file; consumers write it to `OUT_DIR` and `include!()`. Deterministic by construction: buckets in declaration order, within each bucket sorted by recipe_id then method_id.
+## [Autonomous build / Opus 4.8] D-MBX-A6 Phase 1 — planner⟷ractor⟷surreal meta-DTO (contract slice)
+
+**Branch:** claude/sleepy-cori-aRK2x | **Files:**
+- `crates/lance-graph-contract/src/kanban.rs` (NEW) — `KanbanColumn` (6) + `KanbanMove`
+- `crates/lance-graph-contract/src/soa_view.rs` (NEW) — `MailboxSoaView` + `MailboxSoaOwner` borrow traits + fake-impl tests
+- `crates/lance-graph-contract/src/orchestration.rs` (+`StepDomain::Kanban` + 4 arm updates + round-trip test entry)
+- `crates/lance-graph-contract/src/lib.rs` (module decls + re-exports)
+
+**Tests:** `cargo test -p lance-graph-contract` → 485 lib pass (+6 new: 4 kanban, 2 soa_view; orchestration round-trip extended) + integration suites green. `cargo check` clean on `lance-graph-planner`, `cognitive-shader-driver`, `lance-graph-supervisor` (default + `--features supervisor`) — `StepDomain::Kanban` verified additive-safe (all downstream uses are `!=`/`matches!`/`from_step_type`; no exhaustive match without wildcard).
+
+**Outcome:** DONE (contract slice; consumer impls deferred). Realizes the planner⟷ractor⟷surreal wiring as an EXTENSION of the canonical `OrchestrationBridge` surface (lab-vs-canonical ruling — no parallel DTO family) + a zero-dep transparent-SoA-view borrow trait (E-SOA-VIEW-IS-A-BORROW). Honors R1 (view returns `&[T]`, never copies) + R4 (witness = `chain_position` pointer). Deferred: planner-emit (D-MBX-A6 Ph2-3, incl. the {native|JIT|SurrealQL|elixir} strategy set), `impl MailboxSoaView/Owner for MailboxSoA<N>` (cognitive-shader-driver), ractor `ConsumerEnvelope::Kanban` arm, surreal_container read-view (BLOCKED on OQ-11.6 fork).
+
+**Review pattern:** `// ///`-decision-markers → `/code-review` (medium, 1 finding → REFUTED via grep + cargo check) → markers stripped → cargo verify. Design via Opus Plan agent map (LATEST_STATE + lab-vs-canonical + unified-soa-convergence-v1 + orchestration/container/surreal_container/supervisor surfaces).
 
 ---
 

.claude/board/LATEST_STATE.md

@@ -42,6 +42,8 @@
 
 ## Current Contract Inventory (lance-graph-contract)
 
+> **2026-05-30 — PR-in-flight addition** (D-MBX-A6 Phase 1 — planner⟷ractor⟷surreal meta-DTO): `lance_graph_contract::kanban::{KanbanColumn (6: Planning/CognitiveWork/Evaluation/Commit/Plan/Prune), KanbanMove}` — the 4-phase Rubicon kanban transition; `KanbanMove` is `Copy`, ≤16 B, carries `MailboxId` + `witness_chain_position` (R4 pointer) + `libet_offset_us` (−550 ms anchor, D-MBX-8). `lance_graph_contract::soa_view::{MailboxSoaView, MailboxSoaOwner}` — zero-dep **borrow trait** for the transparent zero-copy SoA view (R1 "one SoA never transformed"); `&[T]` column accessors (energy/edges_raw/meta_raw/entity_type) mirror `MailboxSoA::*_at`; the read/owner split makes "view is read-only" structural (surreal implements only the read half). `orchestration::StepDomain::Kanban` variant + `"kanban."` prefix. Consumed via the EXISTING `OrchestrationBridge` (planner emits, ractor owns/drives via `MailboxSoaOwner`, surreal_container projects via read-only `MailboxSoaView`) — NO parallel DTO family (lab-vs-canonical ruling). Contract `[dependencies]` still empty. 485 contract lib tests green (+6 new); `cargo check` clean on planner/cognitive-shader-driver/supervisor (StepDomain variant additive-safe). Consumer impls deferred. See E-SOA-VIEW-IS-A-BORROW; `unified-soa-convergence-v1.md §5+§8.4`.
+>
 > **2026-05-28 — PR-in-flight addition** (bindspace→mailbox migration wave A1-A4): `lance_graph_contract::witness_table::{WitnessEntry, WitnessTable<N=64>}` — column-type primitive resolving the 6-bit W-slot in `CausalEdge64 v2` into a per-cohort `(mailbox_ref: u32, spo_fact_ref: Option<u64>)` table (`mailbox_ref` carries the full canonical `MailboxId`, NOT a truncated cohort-local index — see PR #427 Codex P2 fix). Zero-dep, 3 unit tests, `WitnessTable::{new, get, set, default}`. Cross-ref: `.claude/plans/bindspace-singleton-to-mailbox-soa-v1.md` §10 (architectural refinements landed in same wave). Also in same wave: `cognitive-shader-driver::MailboxSoA<N>` gains four thoughtspace columns (`edges: [CausalEdge64; N]`, `qualia: [QualiaI4_16D; N]`, `meta: [MetaWord; N]`, `entity_type: [u16; N]`) + 8 row accessors; `ShaderDriver` gains transitional `mailboxes: HashMap<MailboxId, MailboxSoA<1024>>` + `with_mailbox()` builder + `mailbox()` read accessor (sibling-shape, additive — singleton untouched). 457 contract+driver tests pass.
 
 Types that EXIST — do NOT re-propose them:

.claude/board/STATUS_BOARD.md

@@ -564,6 +564,7 @@ Plan path: `.claude/plans/unified-soa-convergence-v1.md`. Handover `.claude/hand
 | D-MBX-10 | SoA version byte at layout root (`MailboxSoAHeader`); refuse v(N>M) bytes on v(M) reader; field-isolation matrix tests on every column op (`I-LEGACY-API-FEATURE-GATED` discipline) | lance-graph-contract | 100 | HIGH | **Queued** | foundation — should land early in P2; gates on OQ-11.5 |
 | D-MBX-11 | Lance `=6.0.0 → =6.0.1` patch bump (5 Cargo.toml files identified) | workspace Cargo.toml | 10 | LOW | **Queued (mechanical)** | none — can land in parallel with par-tile prereq |
 | D-MBX-12 | 8-PR workspace-wide consumer alignment: 12.1 AriGraph · 12.2 Vsa16k audit · 12.4 lance-graph · 12.5 planner · 12.6 shader-driver · 12.7 callcenter · 12.8 ontology audit · 12.9 thinking-styles | per-crate | 800 | per-PR | **Queued (multi-PR)** | sequencing per OQ-11.8: 12.4 → 12.5 → 12.6 → 12.7 → 12.1 → 12.9 → 12.2 → 12.8 |
+| D-MBX-A6-P1 | contract slice of D-MBX-A6: `kanban::{KanbanColumn, KanbanMove}` + `soa_view::{MailboxSoaView, MailboxSoaOwner}` + `StepDomain::Kanban` — the planner⟷ractor⟷surreal seam, zero-dep, no parallel DTO family | lance-graph-contract | 340 | HIGH | **In PR** | extends §8.4; +6 tests; downstream cargo-check clean; consumer impls (planner emit / `MailboxSoA` owner-impl / ractor arm / surreal read-view) deferred |
 
 ---
 

crates/lance-graph-contract/src/kanban.rs

@@ -0,0 +1,132 @@
+//! # `kanban` — the 4-phase Rubicon kanban contract (zero-dep).
+//!
+//! The seam where three subsystems meet over the ONE per-mailbox SoA:
+//! - **lance-graph-planner** emits a [`KanbanMove`] (the plan's output unit),
+//! - **ractor** (the mailbox owner, `lance-graph-supervisor`) drives the
+//!   transition — advancing a [`KanbanColumn`] *is* the mailbox lifecycle step,
+//! - **surrealdb** (`surreal_container`) projects the columns as the kanban view
+//!   over SoA-shaped Lance rows.
+//!
+//! Carried across the canonical [`crate::orchestration::OrchestrationBridge`] as a
+//! `UnifiedStep { step_type: "kanban.*" }` ([`crate::orchestration::StepDomain::Kanban`]).
+//!
+//! Spec: `.claude/plans/unified-soa-convergence-v1.md` §5 + §8.4 (D-MBX-A6 Phase 1).
+//!
+//! ## Invariants honoured
+//! - **R1 "one SoA never transformed":** a [`KanbanMove`] is a *transition record*,
+//!   not SoA data — it carries only `Copy` scalars + a pointer, never the SoA.
+//! - **R4 witness-as-pointer:** the witness is a `chain_position` index into the
+//!   source mailbox's witness arc (mirrors
+//!   [`crate::collapse_gate::CollapseGateEmission`]'s `chain_position`), never the
+//!   witnessed data.
+
+use crate::collapse_gate::MailboxId;
+
+/// The four Rubicon phases (+ two terminal exits), Libet-anchored.
+///
+/// The mailbox lifecycle advances through these columns from spawn toward a
+/// terminal column. The discriminants are stable (used as a kanban-column key and
+/// for compact SoA storage) — **do not reorder**.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
+#[repr(u8)]
+pub enum KanbanColumn {
+    /// `t < -550 ms` (Libet readiness-potential window): ractor owns the SoA;
+    /// counterfactual pre-planning / expansion happens here. The spawn state.
+    #[default]
+    Planning = 0,
+    /// `t >= -550 ms`: the SoA mutates under cognitive operations; the Σ-commit
+    /// ratchet advances here.
+    CognitiveWork = 1,
+    /// `t > 0`: read back over the witness arc; residual free-energy assessed.
+    Evaluation = 2,
+    /// Terminal — calcify: commit to Lance SPO-G + AriGraph pointer.
+    Commit = 3,
+    /// Terminal — re-plan: re-enter [`Planning`](KanbanColumn::Planning) carrying
+    /// the witness (the "act differently next time" exit).
+    Plan = 4,
+    /// Terminal — veto: drop the move (Libet "free won't", post-hoc inhibition).
+    Prune = 5,
+}
+
+impl KanbanColumn {
+    /// Is this a terminal column (no further in-cycle transition from here)?
+    #[inline]
+    pub fn is_terminal(self) -> bool {
+        matches!(self, Self::Commit | Self::Plan | Self::Prune)
+    }
+}
+
+/// One kanban transition: the planner's output unit and the ractor's lifecycle step.
+///
+/// `Copy` and small (≤ 16 B) so it rides the airgap as owned microcopy, never a
+/// borrow into the SoA (R1). The witness is a *pointer* (R4).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct KanbanMove {
+    /// The mailbox whose lifecycle is advancing.
+    pub mailbox: MailboxId,
+    /// Column the mailbox is leaving.
+    pub from: KanbanColumn,
+    /// Column the mailbox is entering.
+    pub to: KanbanColumn,
+    /// Witness pointer: position in the source mailbox's witness chain. Mirrors
+    /// [`crate::collapse_gate::CollapseGateEmission`]'s `chain_position` —
+    /// structural time, not a wall-clock stamp (R4).
+    pub witness_chain_position: u32,
+    /// Libet commit anchor: signed micros relative to the act. `-550_000` on the
+    /// `Planning → CognitiveWork` Σ-commit; `0` otherwise. Structural offset only.
+    pub libet_offset_us: i32,
+}
+
+// NOTE (follow-up, D-MBX-A6 Phase 2-3): the planner execution strategy
+// { lance-graph-planner (native) | JIT | SurrealQL | elixir } is intentionally NOT carried
+// on KanbanMove here — the planner-emit slice reuses the planner's existing strategy enum
+// rather than duplicating it. Revisit whether KanbanMove needs an exec-target tag then.
+
+// `KanbanMove` must stay a small owned microcopy (airgap discipline, I1):
+// MailboxId(4) + 2×KanbanColumn(1) + u32(4) + i32(4) packs within 16 B.
+const _: () = assert!(core::mem::size_of::<KanbanMove>() <= 16);
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn kanban_column_discriminants_are_stable() {
+        // Stable column key — do not reorder.
+        assert_eq!(KanbanColumn::Planning as u8, 0);
+        assert_eq!(KanbanColumn::CognitiveWork as u8, 1);
+        assert_eq!(KanbanColumn::Evaluation as u8, 2);
+        assert_eq!(KanbanColumn::Commit as u8, 3);
+        assert_eq!(KanbanColumn::Plan as u8, 4);
+        assert_eq!(KanbanColumn::Prune as u8, 5);
+    }
+
+    #[test]
+    fn default_column_is_planning_the_spawn_state() {
+        assert_eq!(KanbanColumn::default(), KanbanColumn::Planning);
+    }
+
+    #[test]
+    fn terminal_columns_are_commit_plan_prune() {
+        assert!(KanbanColumn::Commit.is_terminal());
+        assert!(KanbanColumn::Plan.is_terminal());
+        assert!(KanbanColumn::Prune.is_terminal());
+        assert!(!KanbanColumn::Planning.is_terminal());
+        assert!(!KanbanColumn::CognitiveWork.is_terminal());
+        assert!(!KanbanColumn::Evaluation.is_terminal());
+    }
+
+    #[test]
+    fn kanban_move_is_copy_and_small() {
+        let m = KanbanMove {
+            mailbox: 42,
+            from: KanbanColumn::Planning,
+            to: KanbanColumn::CognitiveWork,
+            witness_chain_position: 7,
+            libet_offset_us: -550_000,
+        };
+        let n = m; // Copy, not move
+        assert_eq!(m, n);
+        assert!(core::mem::size_of::<KanbanMove>() <= 16);
+    }
+}

crates/lance-graph-contract/src/lib.rs

@@ -58,6 +58,7 @@ pub mod graph_render;
 pub mod hash;
 pub mod high_heel;
 pub mod jit;
+pub mod kanban;
 pub mod literal_graph;
 pub mod mail;
 pub mod manifest;
@@ -85,6 +86,7 @@ pub mod scenario;
 pub mod sensorium;
 pub mod sigma_propagation;
 pub mod sla;
+pub mod soa_view;
 pub mod splat;
 pub mod tax;
 pub mod thinking;
@@ -95,3 +97,5 @@ pub mod world_model;
 
 // Re-exports for the most commonly used collapse_gate types.
 pub use collapse_gate::{CollapseGateEmission, GateDecision, MailboxId, MergeMode};
+pub use kanban::{KanbanColumn, KanbanMove};
+pub use soa_view::{MailboxSoaOwner, MailboxSoaView};

crates/lance-graph-contract/src/orchestration.rs

@@ -49,6 +49,10 @@ pub enum StepDomain {
     Smb,
     /// Medcare reality-check vertical (clinic data sovereignty).
     Medcare,
+    /// 4-phase Rubicon kanban transition over the per-mailbox SoA — the seam
+    /// where the planner (emits), ractor (owns/drives), and surrealdb (projects)
+    /// meet. `step_type` prefix `"kanban."`. See [`crate::kanban`].
+    Kanban,
 }
 
 impl StepDomain {
@@ -72,6 +76,7 @@ impl StepDomain {
             "nd" => Some(Self::Ndarray),
             "smb" => Some(Self::Smb),
             "medcare" => Some(Self::Medcare),
+            "kanban" => Some(Self::Kanban),
             _ => None,
         }
     }
@@ -106,15 +111,18 @@ impl StepDomain {
             // Generic defaults for infrastructure / orchestration domains.
             // These are NOT vertical-facing; they execute the cycle, not
             // the policy. Starter values — tune empirically.
-            Self::Crew | Self::Ladybug | Self::N8n | Self::LanceGraph | Self::Ndarray => {
-                DomainProfile {
-                    audit_retention_days: 30,
-                    auto_action_confidence: 0.70,
-                    escalation: Escalation::Llm,
-                    requires_fail_closed: false,
-                    verb_taxonomy: VerbTaxonomyId::Generic,
-                }
-            }
+            Self::Crew
+            | Self::Ladybug
+            | Self::N8n
+            | Self::LanceGraph
+            | Self::Ndarray
+            | Self::Kanban => DomainProfile {
+                audit_retention_days: 30,
+                auto_action_confidence: 0.70,
+                escalation: Escalation::Llm,
+                requires_fail_closed: false,
+                verb_taxonomy: VerbTaxonomyId::Generic,
+            },
         }
     }
 }
@@ -131,6 +139,7 @@ impl core::fmt::Display for StepDomain {
             Self::Ndarray => "nd",
             Self::Smb => "smb",
             Self::Medcare => "medcare",
+            Self::Kanban => "kanban",
         };
         f.write_str(s)
     }
@@ -236,6 +245,7 @@ mod tests {
             StepDomain::Ndarray,
             StepDomain::Smb,
             StepDomain::Medcare,
+            StepDomain::Kanban,
         ];
         for domain in all {
             let s = domain.to_string();